County firewalls block TCP 6443 between worker nodes and the API server VIP. What breaks, and what should networking open?
Select an answer to reveal the explanation.
Short Explanation
Workers need a clear phone line to the API desk on 6443. If the firewall clips that path to the VIP, joins and kubelet heartbeats suffer. Open TCP 6443 from nodes to the control-plane endpoint—do not confuse it with VXLAN or etcd peer ports.
Full Explanation
The Kubernetes API server listens on TCP 6443 by default. Worker kubelets and control-plane components must reach that endpoint (often via a VIP or load balancer). Blocking 6443 between workers and the API VIP prevents normal cluster operation. etcd and CNI overlay ports are separate concerns and are not substitutes for API connectivity.